RomanSt's questions

I am responsible for a domain which has an SPF record as recommended by various other services that send mail on this domain's behalf.

When setting up Mailchimp, I was surprised to find no documentation on Mailchimp's recommended SPF setup. When I contacted support I was told that Mailchimp basically considers SPF legacy, hasn't used SPF for 6+ months, and thinks having the record doesn't help or hinder. Even going so far as suggesting that I delete our SPF record altogether.

I don't doubt that Mailchimp knows infinitely more about email deliverability than I do. But I find it surprising that Mailchimp wouldn't publish anything explaining this decision, especially considering that every other provider that sends email on our behalf continues to recommend the use of SPF, including G-Suite.

So what's going on, is SPF useless in 2020, should I worry about not having Mailchimp's servers in our SPF record, and should I consider deleting the SPF record altogether?

I've recently noticed a number of significant changes to my IIS configuration, some of which have major implications. I've dug through the daily backups and found that the change coincides with the installation of several security updates on 12 Sep 2014.

The changes are anything but minor:

1. The <handlers> element was locked; the update unlocked it and now any site's directory can have a web.config that adds handler mappings.
2. A whole lot of default handler mappings were added, and got inherited into my sites. So, where previously a site was disallowed to execute, say, an .aspx file, after this update all sites were suddenly able to execute .aspx files from any directory.
3. default.aspx was added to the list of permitted default documents.

plus a few less significant ones, like adding an X-Powered-By header to every single site I run! A full diff is available.

Comparing the last modified timestamp of applicationHost.config and the update log, the update that did this is either KB2972211 or KB2894854 (both have the same installation timestamp so can't tell which one it is). I suspect the former, because IIS and ASP.NET are mentioned in the description.

I'm relatively new to IIS, so I have several questions about this incident:

1. Is this normal for IIS-related security updates to make changes as major as these?
2. Was it really KB2972211, or could it be a malicious change by someone hiding their tracks?
3. Was my IIS misconfigured to start with? E.g. I have deleted the default handler mappings; was I wrong to do so and expect it to stay that way?
4. Are my sites supposed to be able to take such changes to the root config without breaking / suffering security issues?

I'm using IIS 7.5 on Server 2008 R2 to run non-ASP sites, and they don't use .NET either.

Can ASP.NET be completely disabled/uninstalled, so that no ASP.NET security updates are required, and to fix minor annoyances like the appearance of aspnet_client directories etc?

Turning off debug mode in ASP.NET is one of the things that's mentioned even in the most beginner tutorials on ASP.NET security. Unfortunately, in website projects debug mode is the only way to obtain line numbers with exception stacktraces: you can't just enable PDBs while leaving the website in release mode.

Line numbers in stacktraces are exceptionally useful in figuring out the cause of those once-in-a-blue-moon exceptions that only occur in production.

Our server uses custom error handlers, and has tracing disabled. Are there any other ways in which the debug mode can be harmful for security?

OVH offers additional public IPv4s in blocks as small as /30, that is 4 IPs total. As I understand it, strictly speaking two of those are supposed to be unusable. However, OVH allows me to route those to specific MACs (each corresponding to a specific virtual machine).

Are there any gotchas to using the highest and the lowest IP in a block like this?

The only gotcha I found was that when configuring Windows to use the IP address, a smaller (err.. larger?) subnet mask must be specified. OVH support says /32 (255.255.255.255) should be used as the subnet mask for any IP anyway, not just the lowest/highest IP. It seems that internally, they don't route IPs based on subnets anyway, so I can't think of any other potential gotchas.

A number of guides on setting the ASP.NET machineKey via the IIS manager tell me to open up the "Machine Key" section in the Feature View, for example:

My IIS install doesn't have this icon. How do I add it? I've had a good look through the "Add Role Services" but didn't find anything that seemed relevant.

Here's what the list looks like on my server when I select the machine in the list on the left:

(specifically, the ASP.NET postbacks - but even then only some of them)

I have nginx configured to reverse proxy an ASP.NET server. Most of it works perfectly fine. All GET requests work, and most POST requests work too. Most ASP.NET postbacks work. But there is the occasional postback which, for some strange reason that I haven't figured out, fails to ever receive a response, every single time (i.e. it is guaranteed to fail).

This particular server is configured so that one can access the ASP.NET instance directly (bypassing nginx) by specifying a port number. When nginx is bypassed, everything works perfectly and all requests are responded to instantly.

What can I do to debug this further? I haven't been able to get Nginx to log events like starting and ending the upstream requests/responses, let alone their entire bodies. Fiddler can't help because there is nothing wrong with the request from browser to nginx; the issue occurs between nginx and ASP.NET. Any other ideas?

Config excerpt: http://pastebin.com/FyTtuUQZ

It might have something to do with keepalives, because the postback eventually times out after roughly 65 seconds - the time specified in the above config as the keepalive timeout. But this might be a red herring.

_{P.S. It's a development-only server, and the purpose of reverse proxying it is so that we can point several domains at this one machine and have incompatible servers all appear as if they were on port 80. But in order for me to trust nginx reverse-proxying production servers, I need to understand this problem to make sure it won't affect production.}

Suppose you have a Windows Server machine running various sensitive services. Suppose that one of these services is pretty simple, maintaining a small amount of information in a text file, but as a result of being badly coded, has an (unknown) arbitrary code execution vulnerability.

Is it possible to set up a user account for that service such that if a hacker were to exploit this vulnerability successfully, the most damage they could do is read/write this text file, mess up this specific service, and possibly list the files out of C:\Windows, but nothing else?

A naive attempt at doing this immediately runs into a problem: anyone in "Users" can write to C:\Program Files, and removing "Users" from that directory's ACL results in a permission error, making me wonder if, perhaps, it is a very bad idea.

Or is the game already lost if the attacker can execute arbitrary code, regardless of which user account is used? I've always thought Windows NT descendants make it possible to contain this, but now that I've tried, I'm no longer so sure.

I know ZFS has protection against silent corruption, but I'm building a Windows server. Are there options out there for adding local, silent-corruption-protected storage to a Windows server, or is ZFS-over-network the only option?

I would like to pay extra for something that can compute the checksums fast enough to make the hard drive the bottleneck. Are such I/O cards available?

I have recently found out the hard way that Oracle has decided to silently nuke JRE 6 when a JRE7 update is installed.

Is it possible to leave JRE7 on auto-update without breaking JRE6? If not, how else can we ensure JRE6 stays? Is there a better way than manually reinstalling it after every single JRE7 update?

(the legacy apps will hopefully be updated to JRE7 sooner or later, but we didn't write them, so we can't update them)

Can I make Apache or IIS add a specific header if a certain query string is present?

I want every URL with "download=1" in the query string to be served with Content-Disposition: attachment.

_{Weird question title because originally this was about Apache only, but now I've added IIS too.}

When I query the ISP's DNS server for foo.example.com, it comes back with something like this:

;; ANSWER SECTION:
foo.example.com. 159 IN A       192.168.40.20

(note that the IP address is a local one)

When I do the same over DNSMasq, the response is empty; the A record is missing. It works fine for every other address I've tried.

What is this, a mis-configuration of DNSMasq, a bug, or expected behaviour?

I've noticed that my AWS server occasionally starts using a bunch of CPU for no particular reason, looking something like this:

Observe that it does not occur at specific times, but has a very definite pattern to it. It lasts just under an hour.

Remoting to the machine during this occurrence would invariably make it stop happening. Leaving the account permanently logged on allowed me to capture a more fine-grained CPU usage trace. It looked like this:

That's right; the processes that actually consume that CPU are not in the list. Instead, they appear and disappear all the time. ProcMon was obviously the tool for the job, so I captured a trace. This is what I found:

There's also Postgres involved:

However all the CPU usage is by the Winlogon/LogonUI/etc:

Here's a short excerpt of process start and stop events during this occurrence:

Note that postgres is not interleaved with each start/stop of smss/winlogon/etc, but only some of them.

Any ideas why this happens, and how to prevent it?

I have tested rebuilding a Windows Server 2008 RAID-5 after a whole disk fails, and this works pretty well. It's a bit harder to test a few clusters going bad.

Will Windows detect this, correct for it and alert me?

Obviously it can't correct if data just turns to random bytes, but if clusters are unreadable it could reconstruct the data from the remaining volumes because it knows which drive has the bad clusters. But does it actually do this, transparently to the running applications?

Windows privileges (examples) are assigned to accounts and groups, and by default the "SERVICE" built-in principal has a couple of privileges assigned, such as the "impersonate user" privilege.

I want to create a restricted account for a service that doesn't have this privilege. Can I somehow set a "deny" rule for this privilege, just like one can use with file ACLs? Or do I have to remove "SERVICE" from the list of SeImpersonatePrivilege grantees to achieve this? (something I'd rather avoid if I can, since this can conceivably break other services)

_{Edited to correct a brain-cloud-induced conflation of two completely unrelated things into one monstrosity of a question.}

I'd like to create a user account on a Windows Server which can read whatever bits of C:\ it needs to be able to execute programs, but have no read access to D:\ except for D:\Special.

It seems that the only sane way of achieving the former is to make this user part of the Users group. Unfortunately that also gives the user read access to all of D:\. If I add a Deny rule for D:\, however, this rule also applies to D:\Special, and it seems to be impossible to override by design.

Is there any way to do what I want, namely the "usual" Users access to C:\, but on D:\ no access except for read access to D:\Special?

The man qmail-local page states that the Delivered-To header is always added to the email.

For some reason, however, many of my emails are missing it. Namely, those that are sent to users created in "users/assign" using the wildcard notation.

Is this a bug, or are these delivered bypassing qmail-local? How else can I tell which of the wildcard addresses the email was actually delivered to?

When launching an instance, I'm presented with this most cryptic list:

There seems to be absolutely zero documentation on Amazon as to which kernel does what. They explain fairly well what these kernels are for, but without knowing what those numbers mean, kernels appear to be utterly useless.

Where can I find out what a given kernel means, or what the latest kernel is for a given OS?

Here's a command that works fine:

echo Blah: `stat -c %a .`

Is it possible to get find -exec to execute this same thing for every file found, with {} in place of .?

I have a huge number of small files to rsync to a Windows machine. Most of them transferred just fine, but every file with a colon couldn't be transferred because the filename is invalid on Windows.

Is there any practical hack-around that I could use to get those files regardless? For example, some rsync setting or some filename-escaping script that I could pipe rsync through?